Exam Bundle

This observation would validate a different case: A protected iOS app shows a user-facing error because its app protection SDK integration is not supported by the installed app version. It would check 'The updated compatible app receives and enforces the intended policy.' after 'Verify the app's Intune MAM compatibility and deploy a supported build.'. It does not establish success for the stated scenario; the needed evidence is 'The protected supported app connects and an unprotected native app cannot access mail.'.

This observation would validate a different case: A managed Android app receives a configuration key from a public email rather than through controlled policy. It would check 'The app reads its approved endpoint and tenant options without exposing them in user emails.' after 'Create an Intune app configuration policy using supported managed app configuration settings.'. It does not establish success for the stated scenario; the needed evidence is 'The protected supported app connects and an unprotected native app cannot access mail.'.

This observation would validate a different case: A new Teams app version is installed, but app protection appears inactive because a stale user account is signed in. It would check 'Switching to the targeted work account activates the intended data protection controls.' after 'Check which organizational identity and supported app instance is receiving the policy.'. It does not establish success for the stated scenario; the needed evidence is 'The protected supported app connects and an unprotected native app cannot access mail.'.

This action is appropriate for a different case: A finance laptop has BitLocker active but the end user sees a recovery prompt after a firmware change. There, the targeted fix is 'Validate platform security/TPM state and recover using approved key escrow before altering encryption policy.' because firmware and TPM changes can affect boot trust and recovery without indicating absent encryption. The current scenario instead requires 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.' and verification that the approved application executes and the untrusted test binary remains denied.

This action is appropriate for a different case: Defender for Endpoint device risk rises above an approved threshold, but Conditional Access still allows the endpoint unrestricted corporate access. There, the targeted fix is 'Integrate Defender risk with Intune compliance and enforce a compliant-device grant condition.' because risk-based compliance can inform application access decisions. The current scenario instead requires 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.' and verification that the approved application executes and the untrusted test binary remains denied.

This action is appropriate for a different case: An ASR rule blocks a business-approved legacy app, and the service desk suggests turning off all ASR protections. There, the targeted fix is 'Create a tightly scoped policy exception or compatible application update after security review.' because broadly disabling protection creates unnecessary risk. The current scenario instead requires 'Review policy rule trust conditions and test an authorized publisher update before broad rollout.' and verification that the approved application executes and the untrusted test binary remains denied.

This action is appropriate for a different case: A company wants to prevent unprotected native email clients from accessing Exchange Online on personal phones. There, the targeted fix is 'Configure an appropriate Entra Conditional Access approved-app or app-protection requirement for supported clients.' because identity grants can restrict access to clients enforcing enterprise app data controls. The current scenario instead requires 'Apply app protection identity boundaries and restrict organization-to-personal data transfer.' and verification that a controlled copy-to-personal-account test is blocked while work-to-work flows succeed.

This action is appropriate for a different case: A user leaves the organization but their personal phone retains cached corporate data inside a managed app. There, the targeted fix is 'Trigger selective corporate app data wipe for the managed identity where supported.' because app-selective wipe removes company data without deleting unrelated personal files. The current scenario instead requires 'Apply app protection identity boundaries and restrict organization-to-personal data transfer.' and verification that a controlled copy-to-personal-account test is blocked while work-to-work flows succeed.

This action is appropriate for a different case: An organization needs to apply a managed browser home page for work apps without controlling every device browser installation. There, the targeted fix is 'Use managed app configuration for the supported work browser and targeted identity.' because app configuration policies apply specific app settings separately from full device profiles. The current scenario instead requires 'Apply app protection identity boundaries and restrict organization-to-personal data transfer.' and verification that a controlled copy-to-personal-account test is blocked while work-to-work flows succeed.

This observation would validate a different case: A mobile team pushes an Android Wi-Fi profile that references an enterprise certificate missing on the target devices. It would check 'A pilot Android device receives the certificate and connects to the secure SSID.' after 'Deploy the required certificate and an appropriately configured Android Wi-Fi configuration profile.'. It does not establish success for the stated scenario; the needed evidence is 'Screen-reader workflow works on the pilot while required security controls still apply.'.

This observation would validate a different case: A Mac configuration profile is marked succeeded but the security restriction is absent on one OS release. It would check 'Supported macOS pilots enforce the control while incompatible versions are explicitly documented.' after 'Validate macOS version support and applicable payload settings before broad rollout.'. It does not establish success for the stated scenario; the needed evidence is 'Screen-reader workflow works on the pilot while required security controls still apply.'.

This observation would validate a different case: A legacy Group Policy has hundreds of settings and IT needs to know which can move to modern device management. It would check 'A migration report distinguishes supported controls from ones needing redesign.' after 'Use Group Policy analytics to import and assess supported settings migration paths.'. It does not establish success for the stated scenario; the needed evidence is 'Screen-reader workflow works on the pilot while required security controls still apply.'.

This observation would validate a different case: A security admin sees a Security Copilot agent suggest that 500 endpoints are stale and immediately prepares a bulk offboarding job. It would check 'The admin confirms affected IDs and only approved stale devices are offboarded.' after 'Review the Device Offboarding Agent evidence and require authorized admin approval before changes.'. It does not establish success for the stated scenario; the needed evidence is 'The script counts all expected inventory devices across multiple pages.'.

This observation would validate a different case: A PowerShell policy script updates 200 devices without checking that the device inventory changed since its last read. It would check 'The dry run rejects stale selections and records the updated approved device set.' after 'Add preflight freshness checks and compare identifiers before applying bulk changes.'. It does not establish success for the stated scenario; the needed evidence is 'The script counts all expected inventory devices across multiple pages.'.

This observation would validate a different case: An administrator wants to extend device compliance using PowerShell but the custom script is assigned to unsupported macOS targets. It would check 'Supported Windows pilots evaluate the script and unsupported platforms remain excluded.' after 'Scope custom compliance discovery to supported device platforms and policy prerequisites.'. It does not establish success for the stated scenario; the needed evidence is 'The script counts all expected inventory devices across multiple pages.'.

This action is appropriate for a different case: A user wants to apply hotpatch on any Windows 11 computer with no regard for supported edition or baseline. There, the targeted fix is 'Check hotpatch eligibility, supported OS/architecture and necessary baseline state before enabling policy.' because hotpatch is conditional on device prerequisites and its baseline lifecycle. The current scenario instead requires 'Define staged update deployment with supported pause, rollback or remediation processes.' and verification that a simulated failure stops broad rollout and the pilot follows an approved recovery sequence.

This action is appropriate for a different case: Mac laptops should install a new macOS patch outside peak business hours while preserving user notice. There, the targeted fix is 'Deploy supported macOS software update policy through the Intune Settings Catalog.' because managed macOS updates can be staged by compatible OS/device prerequisites. The current scenario instead requires 'Define staged update deployment with supported pause, rollback or remediation processes.' and verification that a simulated failure stops broad rollout and the pilot follows an approved recovery sequence.

This action is appropriate for a different case: A fleet of Samsung Android corporate devices needs firmware updates but the ordinary app update policy changes only application packages. There, the targeted fix is 'Plan supported Android OEM firmware-over-the-air (FOTA) deployment or configuration restrictions.' because Android system firmware updates differ from application-store updates. The current scenario instead requires 'Define staged update deployment with supported pause, rollback or remediation processes.' and verification that a simulated failure stops broad rollout and the pilot follows an approved recovery sequence.

This observation would validate a different case: A regional administrator accidentally modifies another unit's Windows 365 provisioning policy because their administrative rights are global. It would check 'The regional admin can view local Cloud PCs but cannot change the other unit's policy.' after 'Scope Windows 365 and Intune administrative roles to the intended administrative boundary.'. It does not establish success for the stated scenario; the needed evidence is 'The operator collects allowed logs and cannot modify unrelated enrollment policies.'.

This observation would validate a different case: A compliant Windows device is blocked because a Conditional Access policy targets the wrong cloud app or includes a nested exclusion. It would check 'Logs identify the intended policy and the compliant pilot user gains authorized access.' after 'Review Conditional Access policy targeting and sign-in logs for the exact grant condition.'. It does not establish success for the stated scenario; the needed evidence is 'The operator collects allowed logs and cannot modify unrelated enrollment policies.'.

This observation would validate a different case: A sensitive Intune change is submitted and its approver is the same user who requested the change. It would check 'The requester cannot self-approve and a second authorized approver is recorded.' after 'Configure separation of duty in multi-admin approval and audit the approval chain.'. It does not establish success for the stated scenario; the needed evidence is 'The operator collects allowed logs and cannot modify unrelated enrollment policies.'.

This action is appropriate for a different case: A mobile device enrollment is failing and the help desk needs actionable logs before wiping the phone. There, the targeted fix is 'Collect available Intune enrollment and device diagnostic logs for the specific record.' because diagnostics reduce repeated destructive troubleshooting attempts. The current scenario instead requires 'Use the supported Intune device query with valid KQL and an appropriate scope.' and verification that the query returns only eligible devices with the vulnerable app version.

This action is appropriate for a different case: A company-owned lost Android tablet contains sensitive records and must be reset remotely with appropriate incident approval. There, the targeted fix is 'Use an authorized Wipe action on the verified device record with incident tracking.' because a full wipe is appropriate for a lost corporate endpoint when approved. The current scenario instead requires 'Use the supported Intune device query with valid KQL and an appropriate scope.' and verification that the query returns only eligible devices with the vulnerable app version.

This action is appropriate for a different case: A security team wants to refresh Microsoft Defender Antivirus signatures on a set of endpoints without reinstalling the agent. There, the targeted fix is 'Run the supported Defender Antivirus security intelligence update action in Intune.' because security intelligence refresh is distinct from OS upgrades and MDE onboarding. The current scenario instead requires 'Use the supported Intune device query with valid KQL and an appropriate scope.' and verification that the query returns only eligible devices with the vulnerable app version.

This action is appropriate for a different case: A help desk needs remote interactive assistance for users but employees should be able to grant consent to support sessions. There, the targeted fix is 'Configure Microsoft Intune Remote Help with approved roles, tenant configuration and consent behavior.' because remote assistance should be governed and attributable to authorized support staff. The current scenario instead requires 'Plan Microsoft Cloud PKI and required Intune certificate profiles and trust chains.' and verification that a pilot device receives a valid certificate whose issuer chain is accepted by its service.

This action is appropriate for a different case: An analytics dashboard shows severe startup time regression on a model whose drivers changed last week. There, the targeted fix is 'Correlate Advanced Analytics/Endpoint Analytics data with driver versions and recent deployment changes.' because a fleet anomaly needs causal evidence before reversing unrelated policies. The current scenario instead requires 'Plan Microsoft Cloud PKI and required Intune certificate profiles and trust chains.' and verification that a pilot device receives a valid certificate whose issuer chain is accepted by its service.

This action is appropriate for a different case: An endpoint team wants proactive insight into hardware performance regressions across a large fleet, beyond basic inventory. There, the targeted fix is 'Enable eligible Intune Advanced Analytics capabilities and review supported anomaly or risk insights.' because advanced analytics can surface patterns for deeper investigation and remediation decisions. The current scenario instead requires 'Plan Microsoft Cloud PKI and required Intune certificate profiles and trust chains.' and verification that a pilot device receives a valid certificate whose issuer chain is accepted by its service.

This observation would validate a different case: A security team wants all managed Windows PCs to use up-to-date real-time malware protection without editing antivirus settings manually on each endpoint. It would check 'A pilot endpoint reports active protection and the intended antivirus policy state.' after 'Assign a Microsoft Defender Antivirus policy through Intune endpoint security and appropriate scope.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk and laptop each receive their intended controls without cross-assignment.'.

This observation would validate a different case: A device firewall rule appears correctly assigned but does not take effect on machines using the public network profile. It would check 'The pilot blocks the intended port when the connection is classified public.' after 'Inspect the profile-specific rule settings and effective network category on the endpoint.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk and laptop each receive their intended controls without cross-assignment.'.

This observation would validate a different case: An attacker uses Office macros to launch credential theft from a managed Windows laptop. It would check 'A controlled macro-based process launch is blocked without harming approved documents.' after 'Deploy appropriate Attack Surface Reduction rules and validate application compatibility.'. It does not establish success for the stated scenario; the needed evidence is 'The kiosk and laptop each receive their intended controls without cross-assignment.'.

This action is appropriate for a different case: Endpoint Analytics reports poor application reliability but the team monitors only Windows boot speed. There, the targeted fix is 'Use application reliability metrics alongside startup performance in Endpoint Analytics.' because boot metrics alone do not explain crashes and application failures. The current scenario instead requires 'Include stale-device and missing-data treatment in compliance reporting definitions.' and verification that the report explicitly identifies stale devices and does not count them as confirmed compliant.

This action is appropriate for a different case: An Intune report contains sensitive employee device details and should be shared with executives who need only risk totals. There, the targeted fix is 'Aggregate or redact user-level data and apply report access restrictions.' because role-appropriate reporting should minimize disclosure of personal device information. The current scenario instead requires 'Include stale-device and missing-data treatment in compliance reporting definitions.' and verification that the report explicitly identifies stale devices and does not count them as confirmed compliant.

This action is appropriate for a different case: After a corporate app deployment, devices show inconsistent app install results but the dashboard aggregates only successful check-ins. There, the targeted fix is 'Export Intune app installation state per device and failure category.' because enrollment check-in does not prove application deployment completed. The current scenario instead requires 'Include stale-device and missing-data treatment in compliance reporting definitions.' and verification that the report explicitly identifies stale devices and does not count them as confirmed compliant.